Verify bzip2 and zlib downloads.

The bzip2 and zlib authors don't provide https links to download
releases.  However, they do provide md5sums for the releases
on their webpages.
Add Go implementation of md5sum.

This is for platforms that don't ship with the md5sum utility.
Merge pull request #206 from jamesgraves/verify_downloads

Verify bzip2 and zlib downloads.